@mmerterden/multi-agent-pipeline 20.17.0 → 20.17.1

package/pipeline/scripts/usage-identity.mjs

@@ -2,30 +2,44 @@
 /**
  * usage-identity.mjs  -  the GitHub account this machine reports usage under.
  *
- * The reporting identity is the logged-in GitHub account that can read the
- * pipeline repository (`usageLog.accessRepo`, default
+ * The reporting identity is the GitHub account on this machine that can read
+ * the pipeline repository (`usageLog.accessRepo`, default
  * mmerterden/multi-agent-pipeline). Access to that repository is what grants
  * use of the pipeline, so it is also what decides whose name a run carries.
  * The account `gh` happens to have active is not used as such: a machine with
- * a work account and a personal account logged in reports under whichever of
- * the two actually holds access.
+ * a work account and a personal account reports under whichever of the two
+ * actually holds access.
  *
- * Resolution: every github.com account `gh auth status` lists is checked once,
- * in order `usageLog.reportAs` (when it is one of them), the active account,
- * then the rest. Each check runs `gh api repos/<accessRepo>` with that
- * account's token in the child's environment (GH_TOKEN), never on argv and
- * never written anywhere. The first account that can read the repository wins.
+ * Resolution stops at the first account that can read the repository:
  *
- * When none can, the active account (else the first) is used as a fallback and
- * marked so (`fallback: true`, `usageLog.loginFallback`). A work machine often
- * has only an enterprise-managed account logged in, which can never be a
- * collaborator of a personal repository; the server decides whether it accepts
- * that login, and refuses it with a status line when it does not. A fallback is
- * cached for NO_LOGIN_TTL_MS, so an account with access added later takes over.
+ *   1. gh: every github.com account `gh auth status` lists, in order
+ *      `usageLog.reportAs` (when it is one of them), the active account, then
+ *      the rest. Each check runs `gh api repos/<accessRepo>` with that
+ *      account's token in the child's environment (GH_TOKEN).
+ *   2. credential: the token git's credential helper holds for
+ *      https://github.com (`git credential fill`, prompts disabled). Its login
+ *      comes from `GET /user`, its access from `GET /repos/<accessRepo>`, both
+ *      through gh with GH_TOKEN, or straight to the API when gh is missing.
+ *   3. ssh: each private key `ssh -G github.com` names, plus ~/.ssh/id_ed25519,
+ *      id_ecdsa and id_rsa, when its `.pub` sits next to it. `ssh -T` with only
+ *      that key names the login ("Hi <login>!"), and
+ *      `git ls-remote git@github.com:<accessRepo>.git HEAD` with the same key
+ *      proves access. Batch mode throughout, so a key that needs a passphrase
+ *      and is not in ssh-agent is skipped rather than prompted for.
  *
- * The result is cached in prefs as `usageLog.login` + `usageLog.loginCheckedAt`
- * (and `usageLog.loginRepo`; `usageLog.loginReason` says why none qualified), re-checked after LOGIN_TTL_MS, or after
- * NO_LOGIN_TTL_MS when no account had access or the login is a fallback, or on `--refresh`.
+ * No token is ever put on an argv, printed or written anywhere. A missing gh,
+ * git or ssh binary, or any failed check, only means "no candidate".
+ *
+ * When no account qualifies the login is null and `reason` says what was tried
+ * in one line; nothing is reported under another account.
+ *
+ * The result is cached in prefs as `usageLog.login`, `usageLog.loginMethod`
+ * (gh | credential | ssh), `usageLog.loginKey` (the key path, ssh only),
+ * `usageLog.loginRepo`, `usageLog.loginCheckedAt` and `usageLog.loginReason`
+ * (why none qualified), re-checked after LOGIN_TTL_MS, after NO_LOGIN_TTL_MS
+ * when no account had access, when the cached key file is gone, or on
+ * `--refresh`. A cache entry marked `usageLog.loginFallback` (written by
+ * 20.17.0) is never served.
  *
  * Usage:
  *   node usage-identity.mjs [--refresh] [--prefs <path>] [--json]
@@ -37,7 +51,7 @@
 
 import { existsSync, readFileSync } from "node:fs";
 import { execFileSync, spawnSync } from "node:child_process";
-import { homedir } from "node:os";
+import { homedir, userInfo } from "node:os";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { lockTimeoutFrom, updateJsonFileSync } from "../lib/json-file-lock.mjs";
@@ -46,7 +60,13 @@ export const ACCESS_REPO_DEFAULT = "mmerterden/multi-agent-pipeline";
 export const LOGIN_TTL_MS = 7 * 24 * 3_600_000;
 export const NO_LOGIN_TTL_MS = 24 * 3_600_000;
 const GH_TIMEOUT_MS = 6000;
+export const SSH_TIMEOUT_MS = 12000;
+const SSH_CONNECT_TIMEOUT_S = 8;
+const MAX_SSH_KEYS = 8;
 const HOST = "github.com";
+const API_DEFAULT = "https://api.github.com";
+const DEFAULT_KEYS = ["id_ed25519", "id_ecdsa", "id_rsa"];
+export const LOGIN_METHODS = ["gh", "credential", "ssh"];
 const LOGIN_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,38}$/;
 const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 
@@ -66,6 +86,28 @@ function ghBin(env) {
   return env.MA_GH_BIN || "gh";
 }
 
+function gitBin(env) {
+  return env.MA_GIT_BIN || "git";
+}
+
+function sshBin(env) {
+  return env.MA_SSH_BIN || "ssh";
+}
+
+export function sshKeygenBin(env = process.env) {
+  return env.MA_SSH_KEYGEN_BIN || "ssh-keygen";
+}
+
+function homeOf(env) {
+  return env.HOME || homedir();
+}
+
+/** `~/...` for a path under the home directory, for status lines. */
+export function displayPath(path, env = process.env) {
+  const home = homeOf(env);
+  return path && home && path.startsWith(`${home}/`) ? `~${path.slice(home.length)}` : path;
+}
+
 export function accessRepoOf(prefs) {
   const r = prefs?.global?.usageLog?.accessRepo;
   return typeof r === "string" && REPO_RE.test(r.trim()) ? r.trim() : ACCESS_REPO_DEFAULT;
@@ -164,9 +206,182 @@ function orderCandidates(accounts, preferred) {
 }
 
 /**
- * Check each logged-in account against the access repository, live.
- * Returns { login, fallback, reason }: the first account with access, else the
- * active (or first) account with `fallback: true`, else login null.
+ * The token git's credential helper holds for https://github.com, or "".
+ * Prompts are disabled (terminal, askpass and helper UI), so a
+ * machine without a stored credential answers at once. The token is read from
+ * the helper's stdout and only ever passed on in a child's environment.
+ */
+export function credentialToken(env = process.env) {
+  const r = spawnSync(gitBin(env), ["credential", "fill"], {
+    input: `protocol=https\nhost=${HOST}\n\n`,
+    encoding: "utf8",
+    timeout: GH_TIMEOUT_MS,
+    stdio: ["pipe", "pipe", "ignore"],
+    env: {
+      ...env,
+      GIT_TERMINAL_PROMPT: "0",
+      GCM_INTERACTIVE: "never",
+      GIT_ASKPASS: "",
+      SSH_ASKPASS: "",
+    },
+  });
+  if (r.status !== 0 || typeof r.stdout !== "string") return "";
+  const line = r.stdout.split("\n").find((l) => l.startsWith("password="));
+  return line ? line.slice("password=".length).trim() : "";
+}
+
+function apiBase(env) {
+  const v = String(env.MA_GITHUB_API_URL || "");
+  return /^http:\/\/(127\.0\.0\.1|localhost)(:\d+)?$/.test(v) ? v : API_DEFAULT;
+}
+
+const API_CHECK = `
+const base = process.env.MA_CHECK_API;
+const repo = process.env.MA_CHECK_REPO;
+const headers = {
+  Authorization: "Bearer " + process.env.MA_CHECK_TOKEN,
+  Accept: "application/vnd.github+json",
+  "User-Agent": "multi-agent-pipeline",
+};
+const get = (path) =>
+  fetch(base + path, { headers, redirect: "error", signal: AbortSignal.timeout(${GH_TIMEOUT_MS}) });
+(async () => {
+  const u = await get("/user");
+  if (!u.ok) process.exit(1);
+  const login = (await u.json())?.login;
+  const r = await get("/repos/" + repo);
+  if (!r.ok) process.exit(1);
+  process.stdout.write(String(login || ""));
+})().catch(() => process.exit(1));
+`;
+
+/**
+ * The login a token belongs to, when that login can read `repo`; else null.
+ * Through gh when it is installed, otherwise a direct API call from a child
+ * node process. Either way the token travels in the child's environment.
+ */
+function tokenLoginWithAccess(token, repo, env) {
+  const who = spawnSync(ghBin(env), ["api", "user", "--jq", ".login"], {
+    encoding: "utf8",
+    timeout: GH_TIMEOUT_MS,
+    stdio: ["ignore", "pipe", "ignore"],
+    env: { ...env, GH_TOKEN: token, GH_HOST: HOST, GITHUB_TOKEN: "" },
+  });
+  if (who.error?.code === "ENOENT") {
+    const r = spawnSync(process.execPath, ["-e", API_CHECK], {
+      encoding: "utf8",
+      timeout: GH_TIMEOUT_MS * 2,
+      stdio: ["ignore", "pipe", "ignore"],
+      env: { ...env, MA_CHECK_TOKEN: token, MA_CHECK_REPO: repo, MA_CHECK_API: apiBase(env) },
+    });
+    const login = (r.stdout || "").trim();
+    return r.status === 0 && LOGIN_RE.test(login) ? login : null;
+  }
+  const login = (who.stdout || "").trim();
+  if (who.status !== 0 || !LOGIN_RE.test(login)) return null;
+  return canRead(repo, token, env) ? login : null;
+}
+
+function shQuote(s) {
+  return `'${String(s).replace(/'/g, "'\\''")}'`;
+}
+
+const SSH_FLAGS = [
+  "-o",
+  "IdentitiesOnly=yes",
+  "-o",
+  "BatchMode=yes",
+  "-o",
+  `ConnectTimeout=${SSH_CONNECT_TIMEOUT_S}`,
+  "-o",
+  "StrictHostKeyChecking=accept-new",
+];
+
+function sshEnv(env) {
+  return { ...env, SSH_ASKPASS_REQUIRE: "never", GIT_TERMINAL_PROMPT: "0" };
+}
+
+function expandIdentity(raw, env) {
+  const home = homeOf(env);
+  let user = env.USER || "";
+  if (!user) {
+    try {
+      user = userInfo().username;
+    } catch {
+      user = "";
+    }
+  }
+  const parts = raw
+    .trim()
+    .replace(/^"(.*)"$/, "$1")
+    .replace(/^~(?=\/|$)/, home)
+    .split("%%")
+    .map((part) => part.replace(/%d/g, home).replace(/%u/g, user).replace(/%h/g, HOST));
+  return parts.some((part) => part.includes("%")) ? null : parts.join("%");
+}
+
+function usableKey(path) {
+  if (!path) return false;
+  if (path.endsWith(".pub")) return existsSync(path);
+  return existsSync(path) && existsSync(`${path}.pub`);
+}
+
+/**
+ * Private-key paths worth trying for github.com: what `ssh -G github.com`
+ * names, then the default key names under ~/.ssh, each kept only when its
+ * `.pub` exists (a `.pub` named directly stands for a key held by an agent).
+ * Empty when ssh is not installed.
+ */
+export function sshKeyCandidates(env = process.env) {
+  const r = spawnSync(sshBin(env), ["-G", HOST], {
+    encoding: "utf8",
+    timeout: GH_TIMEOUT_MS,
+    stdio: ["ignore", "pipe", "ignore"],
+    env,
+  });
+  if (r.error) return [];
+  const listed = [];
+  for (const line of (r.stdout || "").split("\n")) {
+    const m = line.match(/^identityfile\s+(.+)$/i);
+    if (m) listed.push(expandIdentity(m[1], env));
+  }
+  const defaults = DEFAULT_KEYS.map((n) => join(homeOf(env), ".ssh", n));
+  const out = [];
+  for (const p of [...listed, ...defaults]) {
+    if (p && !out.includes(p) && usableKey(p)) out.push(p);
+  }
+  return out.slice(0, MAX_SSH_KEYS);
+}
+
+/** The GitHub login an SSH key authenticates as, from `ssh -T`; else null. */
+export function sshLogin(key, env = process.env) {
+  const r = spawnSync(sshBin(env), ["-i", key, ...SSH_FLAGS, "-T", `git@${HOST}`], {
+    encoding: "utf8",
+    timeout: SSH_TIMEOUT_MS,
+    stdio: ["ignore", "pipe", "pipe"],
+    env: sshEnv(env),
+  });
+  if (r.error) return null;
+  const m = `${r.stderr || ""}\n${r.stdout || ""}`.match(/Hi ([^\s!]+)!/);
+  return m && LOGIN_RE.test(m[1]) ? m[1] : null;
+}
+
+function sshCanRead(key, repo, env) {
+  const command = [shQuote(sshBin(env)), "-i", shQuote(key), ...SSH_FLAGS].join(" ");
+  const r = spawnSync(gitBin(env), ["ls-remote", `git@${HOST}:${repo}.git`, "HEAD"], {
+    encoding: "utf8",
+    timeout: SSH_TIMEOUT_MS,
+    stdio: ["ignore", "ignore", "ignore"],
+    env: { ...sshEnv(env), GIT_SSH_COMMAND: command },
+  });
+  return r.status === 0;
+}
+
+/**
+ * Check the accounts on this machine against the access repository, live, in
+ * the order gh, git credential helper, SSH keys. Returns
+ * { login, method, key, reason }: the first account with access, else login
+ * null with a one-line reason naming what was tried.
  */
 export function checkAccess({
   repo = ACCESS_REPO_DEFAULT,
@@ -174,33 +389,71 @@ export function checkAccess({
   env = process.env,
 } = {}) {
   const accounts = listAccounts({ env });
-  if (accounts.length === 0) {
+  for (const a of orderCandidates(accounts, preferred)) {
+    const token = tokenFor(a.login, env);
+    if (token && canRead(repo, token, env)) {
+      return { login: a.login, method: "gh", key: null, reason: `can read ${repo}` };
+    }
+  }
+
+  const cred = credentialToken(env);
+  const credLogin = cred ? tokenLoginWithAccess(cred, repo, env) : null;
+  if (credLogin) {
     return {
-      login: null,
-      fallback: false,
-      reason: `no GitHub account is logged in to gh, so ${repo} cannot be checked`,
+      login: credLogin,
+      method: "credential",
+      key: null,
+      reason: `can read ${repo}`,
     };
   }
-  const ordered = orderCandidates(accounts, preferred);
-  for (const a of ordered) {
-    const token = tokenFor(a.login, env);
-    if (token && canRead(repo, token, env)) {
-      return { login: a.login, fallback: false, reason: `can read ${repo}` };
+
+  const keys = sshKeyCandidates(env);
+  const sshLogins = [];
+  for (const key of keys) {
+    const login = sshLogin(key, env);
+    if (!login) continue;
+    sshLogins.push(login);
+    if (sshCanRead(key, repo, env)) {
+      return {
+        login,
+        method: "ssh",
+        key,
+        reason: `can read ${repo}`,
+      };
     }
   }
-  const fallback = accounts.find((a) => a.active) || accounts[0];
+
+  const ghPart = accounts.length ? accounts.map((a) => a.login).join(", ") : "none";
+  const credPart = cred ? "a token without access" : "none";
+  const sshPart = keys.length
+    ? `${keys.length} tried${sshLogins.length ? ` (${[...new Set(sshLogins)].join(", ")})` : ""}`
+    : "none";
   return {
-    login: fallback.login,
-    fallback: true,
-    reason: `none of the logged-in GitHub accounts (${accounts.map((a) => a.login).join(", ")}) can read ${repo}; the server decides whether it accepts ${fallback.login}`,
+    login: null,
+    method: null,
+    key: null,
+    reason: `no GitHub account on this machine can read ${repo} (gh: ${ghPart}; git credential: ${credPart}; SSH keys: ${sshPart})`,
   };
 }
 
+function cachedMethod(u) {
+  if (u.loginMethod === undefined || u.loginMethod === null) return "gh";
+  return LOGIN_METHODS.includes(u.loginMethod) ? u.loginMethod : null;
+}
+
 function cacheFresh(u, repo, now) {
   const at = Date.parse(u?.loginCheckedAt || "");
   if (Number.isNaN(at)) return false;
   if ((u.loginRepo || ACCESS_REPO_DEFAULT) !== repo) return false;
-  const ttl = u.login && u.loginFallback !== true ? LOGIN_TTL_MS : NO_LOGIN_TTL_MS;
+  if (u.loginFallback === true) return false;
+  if (u.login) {
+    const method = cachedMethod(u);
+    if (!method) return false;
+    if (method === "ssh" && !(typeof u.loginKey === "string" && usableKey(u.loginKey))) {
+      return false;
+    }
+  }
+  const ttl = u.login ? LOGIN_TTL_MS : NO_LOGIN_TTL_MS;
   return now - at < ttl && now >= at;
 }
 
@@ -238,20 +491,20 @@ export function resolveReportingLogin({
   const repo = accessRepoOf(prefs);
   if (!refresh && cacheFresh(u, repo, now)) {
     if (typeof u.login === "string" && LOGIN_RE.test(u.login)) {
-      if (u.loginFallback === true) {
-        return {
-          login: u.login,
-          fallback: true,
-          reason: u.loginReason || `cached: no logged-in GitHub account can read ${repo}`,
-          cached: true,
-        };
-      }
-      return { login: u.login, fallback: false, reason: `cached: can read ${repo}`, cached: true };
+      const method = cachedMethod(u);
+      return {
+        login: u.login,
+        method,
+        key: method === "ssh" ? u.loginKey : null,
+        reason: `cached: can read ${repo}`,
+        cached: true,
+      };
     }
     return {
       login: null,
-      fallback: false,
-      reason: u.loginReason || `cached: no logged-in GitHub account can read ${repo}`,
+      method: null,
+      key: null,
+      reason: u.loginReason || `cached: no GitHub account on this machine can read ${repo}`,
       cached: true,
     };
   }
@@ -262,10 +515,12 @@ export function resolveReportingLogin({
       prefsPath,
       {
         login: result.login,
-        loginFallback: result.fallback,
+        loginMethod: result.method,
+        loginKey: result.method === "ssh" ? result.key : null,
+        loginFallback: undefined,
         loginRepo: repo,
         loginCheckedAt: new Date(now).toISOString(),
-        loginReason: result.login && !result.fallback ? null : result.reason,
+        loginReason: result.login ? null : result.reason,
       },
       env,
     );
@@ -287,12 +542,16 @@ function main(argv) {
   });
   if (opts.json) {
     process.stdout.write(
-      `${JSON.stringify({ login: r.login, fallback: r.fallback, reason: r.reason, cached: r.cached })}\n`,
+      `${JSON.stringify({ login: r.login, method: r.method, key: r.key, reason: r.reason, cached: r.cached })}\n`,
     );
-  } else if (r.login && r.fallback) {
-    process.stdout.write(`usage identity: ${r.login} (fallback - ${r.reason})\n`);
   } else if (r.login) {
-    process.stdout.write(`usage identity: ${r.login} (${r.reason})\n`);
+    const via =
+      r.method === "ssh"
+        ? `SSH key ${displayPath(r.key)}`
+        : r.method === "credential"
+          ? "git credential helper"
+          : "gh";
+    process.stdout.write(`usage identity: ${r.login} (${via}; ${r.reason})\n`);
   } else {
     process.stdout.write(`usage identity: none - ${r.reason}; nothing will be reported\n`);
   }